VMware Carbon Black EDR Advanced Analyst Training

This one-day course teaches you how to use the VMware Carbon Black® EDR™ product during incident response. Using the SANS PICERL framework, you will configure the server and perform an investigation on a possible incident. This course provides guidance on using Carbon Black EDR capabilities throughout an incident with an in-depth, hands-on, scenario-based lab.
Course Details


1 day


Complete VMware Carbon Black EDR Administrator course

Target Audience

Security Operations personnel including analyst and managers

Skills Gained

  • Utilize Carbon Black EDR throughout an incident
  • Implement a baseline configuration for Carbon Black EDR
  • Determine if an alert is a true or false positive
  • Fully scope out an attack from moment of compromise
  • Describe Carbon Black EDR capabilities available to respond to an incident
  • Create addition detection controls to increase security
Course Outline
  • VMware Carbon Black EDR & Incident Response
    • Framework identification and process
  • Preparation
    • Implement the Carbon Black EDR instance according to organizational requirements
  • Identification
    • Use initial detection mechanisms
    • Process alerts
    • Proactive threat hunting
    • Incident determination
  • Containment
    • Incident scoping
    • Artifact collection
    • Investigation
  • Eradication
    • Hash banning
    • Removing artifacts
    • Continuous monitoring
  • Recovery
    • Rebuilding endpoints
    • Getting to a more secure state
  • Lessons Learned
    • Tuning Carbon Black EDR
    • Incident close out
  • Product Alignment
    • VMware Carbon Black EDR